Vulnerability-Lookup

CVE-2026-84869 (GCVE-0-2026-84869)

Vulnerability from cvelistv5 – Published: 2026-09-08 19:29 – Updated: 2026-09-12 03:55

CISA Previdian

Title

ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions

Summary

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 00:00 UTC

CWE

CWE-862 - Missing Authorization
CWE-269 - Improper Privilege Management

Assigner

ConnectWise CNA under the mitre root

CNA scorecard – unranked: 4 records in the last 180 days, 10 needed details

References

5 references

URL	Tags
https://www.connectwise.com/company/trust/securit…
https://github.com/ConnectWise-Advisories/Disclos…
https://www.connectwise.com/company/trust/advisories
https://www.huntress.com/blog/rogue-screenconnect…	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version	CPE status
ConnectWise	ScreenConnect	Affected: All versions prior to 26.6.5	guessed

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: cfd55757-60bf-42b4-8579-b98e3aa79248

Vulnerability ID: CVE-2026-84869

Status: Confirmed

Status Updated: 2026-09-11 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2026-09-11

Asserted: 2026-09-11

Scope

Notes: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability | Affected: ConnectWise / ScreenConnect | Description: ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-84869

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-269 CWE-862
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	ScreenConnect
Due Date	2026-09-14
Date Added	2026-09-11
Vendorproject	ConnectWise
Vulnerabilityname	ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2026-84869

Created: 2026-09-11 19:00 UTC | Updated: 2026-11-04 13:01 UTC

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 8c0c15ad-9774-4257-a684-261787a40b66

Vulnerability ID: CVE-2026-84869

Status: Confirmed

Status Updated: 2026-09-09 07:51 UTC

Exploited: Yes

Timestamps

First Seen: 2026-09-09

Asserted: 2026-09-09

Scope

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: previdian

Details

Feed	Previdian (previdian.com)
Title	ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
Cve Id	CVE-2026-84869
Vendor	ConnectWise
Ghsa Id	GHSA-RC8V-F46M-JCGM
Product	ScreenConnect
Added Date	2026-09-09T07:51:00.000Z
Cvss Score	9.9
Epss Score	0.00924
Previous Ids
Cvss Severity	CRITICAL
Virtual Patch	False
Cvss Estimated	False
Epss Percentile	0.60472
Used In Malware	unknown
Vulnerability Id	CVE-2026-84869
Ahead Of Cisa Kev	`{ "count": 2, "unit": "day" }`
Not Yet In Cisa Kev	False

References

Created: 2026-09-10 08:00 UTC | Updated: 2026-11-04 13:01 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84869",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-09-11",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-12T03:55:19.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://www.huntress.com/blog/rogue-screenconnect-installations"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-09-11T00:00:00.000Z",
            "value": "CVE-2026-84869 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ScreenConnect",
          "vendor": "ConnectWise",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 26.6.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
            }
          ],
          "value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T19:29:33.630Z",
        "orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
        "shortName": "ConnectWise"
      },
      "references": [
        {
          "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin"
        },
        {
          "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869"
        },
        {
          "url": "https://www.connectwise.com/company/trust/advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cb\u003eCloud:\u0026nbsp;\u003c/b\u003e\u003cspan\u003eUpdated to the latest release. We recommend that\npartners \u003c/span\u003e\u003ca href=\"https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client\"\u003ereinstall their host clients\u003c/a\u003e\u003cspan\u003e and \u003c/span\u003e\u003ca href=\"https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent\"\u003eupdate their access agents\u003c/a\u003e\u003cspan\u003e.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cb\u003eOn-prem\u003c/b\u003e:\u0026nbsp;\u003cspan\u003eUpgrade to ScreenConnect client version \u003c/span\u003e\u003cspan\u003e26.6.5 \u003c/span\u003e\u003cspan\u003eor later.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cb\u003eAutomate-integrated ScreenConnect deployments:\u0026nbsp;\u003c/b\u003e\u003cspan\u003eAutomate partners are eligible to update their integrated\non-premises ScreenConnect installation as long as their Automate Assurance\nsubscription is active. Automate partners should apply the ScreenConnect \u003c/span\u003e\u003cspan\u003e26.6.5 \u003c/span\u003e\u003cspan\u003eupdate through Automate\nProduct Updates.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Cloud:\u00a0Updated to the latest release. We recommend that\npartners  reinstall their host clients https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client  and  update their access agents https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent .\n\n\n\nOn-prem:\u00a0Upgrade to ScreenConnect client version 26.6.5 or later.\n\n\n\nAutomate-integrated ScreenConnect deployments:\u00a0Automate partners are eligible to update their integrated\non-premises ScreenConnect installation as long as their Automate Assurance\nsubscription is active. Automate partners should apply the ScreenConnect 26.6.5 update through Automate\nProduct Updates."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIf you are\nunable to apply the update immediately due to maintenance windows or\nchange-freeze policies, you can implement the following as a temporary\nmitigation to help reduce exposure until the update can be applied. \u003cb\u003eThis is\nnot a substitute for installing the security update\u003c/b\u003e.\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e\u003col\u003e\u003cli\u003eNavigate to the \u003cb\u003eAdministration \u0026gt; Security \u0026gt; Roles\u003c/b\u003e section. \u003c/li\u003e\u003cli\u003eEdit\na role, review each session group that has permissions assigned to it, and\ndeselect the \u003cb\u003eTransferFiles\u003c/b\u003e permission if it is selected.\u003c/li\u003e\u003cli\u003eSave\nyour changes. Repeat for each role.\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "If you are\nunable to apply the update immediately due to maintenance windows or\nchange-freeze policies, you can implement the following as a temporary\nmitigation to help reduce exposure until the update can be applied. This is\nnot a substitute for installing the security update.\n\n\n\n\n\n\n\n  *  Navigate to the Administration \u003e Security \u003e Roles section. \n  *  Edit\na role, review each session group that has permissions assigned to it, and\ndeselect the TransferFiles permission if it is selected.\n  *  Save\nyour changes. Repeat for each role."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
    "assignerShortName": "ConnectWise",
    "cveId": "CVE-2026-84869",
    "datePublished": "2026-09-08T19:29:33.630Z",
    "dateReserved": "2026-09-02T13:57:51.898Z",
    "dateUpdated": "2026-09-12T03:55:19.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-84869",
      "date": "2026-11-14",
      "epss": "0.01173",
      "percentile": "0.67983"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "ScreenConnect",
                "vendor": "ConnectWise",
                "versions": [
                  {
                    "status": "affected",
                    "version": "All versions prior to 26.6.5"
                  }
                ]
              }
            ],
            "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"
          }
        ],
        "cisaActionDue": "2026-09-14",
        "cisaExploitAdd": "2026-09-11",
        "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
        "cisaVulnerabilityName": "ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "270783CF-B4ED-4608-A583-A9F7B80DC877",
                    "versionEndExcluding": "26.6.5.9742",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
          }
        ],
        "id": "CVE-2026-84869",
        "lastModified": "2026-09-12T04:16:42.757",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.9,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 6.0,
              "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-84869",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-08T20:18:51.147",
        "references": [
          {
            "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869"
          },
          {
            "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.connectwise.com/company/trust/advisories"
          },
          {
            "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.huntress.com/blog/rogue-screenconnect-installations"
          }
        ],
        "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-269"
              },
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-84869",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-11T18:50:39.725092Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2026-09-11",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-09T20:46:25.354Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "third-party-advisory"
                ],
                "url": "https://www.huntress.com/blog/rogue-screenconnect-installations"
              },
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2026-09-11T00:00:00.000Z",
                "value": "CVE-2026-84869 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "ScreenConnect",
              "vendor": "ConnectWise",
              "versions": [
                {
                  "status": "affected",
                  "version": "All versions prior to 26.6.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
                }
              ],
              "value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-1",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.9,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862 Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-269",
                  "description": "CWE-269 Improper Privilege Management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-08T19:29:33.630Z",
            "orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
            "shortName": "ConnectWise"
          },
          "references": [
            {
              "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin"
            },
            {
              "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869"
            },
            {
              "url": "https://www.connectwise.com/company/trust/advisories"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003e\u003cb\u003eCloud:\u0026nbsp;\u003c/b\u003e\u003cspan\u003eUpdated to the latest release. We recommend that\npartners \u003c/span\u003e\u003ca href=\"https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client\"\u003ereinstall their host clients\u003c/a\u003e\u003cspan\u003e and \u003c/span\u003e\u003ca href=\"https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent\"\u003eupdate their access agents\u003c/a\u003e\u003cspan\u003e.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cb\u003eOn-prem\u003c/b\u003e:\u0026nbsp;\u003cspan\u003eUpgrade to ScreenConnect client version \u003c/span\u003e\u003cspan\u003e26.6.5 \u003c/span\u003e\u003cspan\u003eor later.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cb\u003eAutomate-integrated ScreenConnect deployments:\u0026nbsp;\u003c/b\u003e\u003cspan\u003eAutomate partners are eligible to update their integrated\non-premises ScreenConnect installation as long as their Automate Assurance\nsubscription is active. Automate partners should apply the ScreenConnect \u003c/span\u003e\u003cspan\u003e26.6.5 \u003c/span\u003e\u003cspan\u003eupdate through Automate\nProduct Updates.\u003c/span\u003e\u003c/p\u003e"
                }
              ],
              "value": "Cloud:\u00a0Updated to the latest release. We recommend that\npartners  reinstall their host clients https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client  and  update their access agents https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent .\n\n\n\nOn-prem:\u00a0Upgrade to ScreenConnect client version 26.6.5 or later.\n\n\n\nAutomate-integrated ScreenConnect deployments:\u00a0Automate partners are eligible to update their integrated\non-premises ScreenConnect installation as long as their Automate Assurance\nsubscription is active. Automate partners should apply the ScreenConnect 26.6.5 update through Automate\nProduct Updates."
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eIf you are\nunable to apply the update immediately due to maintenance windows or\nchange-freeze policies, you can implement the following as a temporary\nmitigation to help reduce exposure until the update can be applied. \u003cb\u003eThis is\nnot a substitute for installing the security update\u003c/b\u003e.\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e\u003col\u003e\u003cli\u003eNavigate to the \u003cb\u003eAdministration \u0026gt; Security \u0026gt; Roles\u003c/b\u003e section. \u003c/li\u003e\u003cli\u003eEdit\na role, review each session group that has permissions assigned to it, and\ndeselect the \u003cb\u003eTransferFiles\u003c/b\u003e permission if it is selected.\u003c/li\u003e\u003cli\u003eSave\nyour changes. Repeat for each role.\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003c/p\u003e"
                }
              ],
              "value": "If you are\nunable to apply the update immediately due to maintenance windows or\nchange-freeze policies, you can implement the following as a temporary\nmitigation to help reduce exposure until the update can be applied. This is\nnot a substitute for installing the security update.\n\n\n\n\n\n\n\n  *  Navigate to the Administration \u003e Security \u003e Roles section. \n  *  Edit\na role, review each session group that has permissions assigned to it, and\ndeselect the TransferFiles permission if it is selected.\n  *  Save\nyour changes. Repeat for each role."
            }
          ],
          "x_generator": {
            "engine": "Vulnogram 1.0.5"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
        "assignerShortName": "ConnectWise",
        "cveId": "CVE-2026-84869",
        "datePublished": "2026-09-08T19:29:33.630Z",
        "dateReserved": "2026-09-02T13:57:51.898Z",
        "dateUpdated": "2026-09-12T03:55:19.450Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-84869

Vulnerability from fkie_nvd - Published: 2026-09-08 20:18 - Updated: 2026-09-12 04:16

CISA Previdian

Severity

9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

References

URL	Tags
7d616e1a-3288-43b1-a0dd-0a65d3e70a49	https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869	Third Party Advisory
7d616e1a-3288-43b1-a0dd-0a65d3e70a49	https://www.connectwise.com/company/trust/advisories	Vendor Advisory
7d616e1a-3288-43b1-a0dd-0a65d3e70a49	https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869	US Government Resource
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.huntress.com/blog/rogue-screenconnect-installations	Third Party Advisory

Impacted products

	Vendor	Product	Version
	connectwise	screenconnect	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "ScreenConnect",
          "vendor": "ConnectWise",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 26.6.5"
            }
          ]
        }
      ],
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"
    }
  ],
  "cisaActionDue": "2026-09-14",
  "cisaExploitAdd": "2026-09-11",
  "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "cisaVulnerabilityName": "ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "270783CF-B4ED-4608-A583-A9F7B80DC877",
              "versionEndExcluding": "26.6.5.9742",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
    }
  ],
  "id": "CVE-2026-84869",
  "lastModified": "2026-09-12T04:16:42.757",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-84869",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-10T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-08T20:18:51.147",
  "references": [
    {
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869"
    },
    {
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.connectwise.com/company/trust/advisories"
    },
    {
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.huntress.com/blog/rogue-screenconnect-installations"
    }
  ],
  "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
      "type": "Secondary"
    }
  ]
}

GHSA-RC8V-F46M-JCGM

Vulnerability from github – Published: 2026-09-08 21:34 – Updated: 2026-09-11 21:31

Details

Severity

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-84869"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T20:18:51Z",
    "severity": "CRITICAL"
  },
  "details": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.",
  "id": "GHSA-rc8v-f46m-jcgm",
  "modified": "2026-09-11T21:31:17Z",
  "published": "2026-09-08T21:34:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84869"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
    },
    {
      "type": "WEB",
      "url": "https://www.connectwise.com/company/trust/advisories"
    },
    {
      "type": "WEB",
      "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin"
    },
    {
      "type": "WEB",
      "url": "https://www.huntress.com/blog/rogue-screenconnect-installations"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-3256

Vulnerability from csaf_certbund - Published: 2026-09-08 22:00 - Updated: 2026-09-09 22:00

Summary

ConnectWise ScreenConnect: Schwachstelle ermöglicht Codeausführung

Severity

Hoch

Scope

1 vulnerability in this advisory, including CVE-2026-84869.

CVE-2026-84869

Known affected: 2 products

Open the full advisory

Solutions

CNA · ConnectWise

Cloud: Updated to the latest release. We recommend that partners reinstall their host clients https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client and update their access agents https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent . On-prem: Upgrade to ScreenConnect client version 26.6.5 or later. Automate-integrated ScreenConnect deployments: Automate partners are eligible to update their integrated on-premises ScreenConnect installation as long as their Automate Assurance subscription is active. Automate partners should apply the ScreenConnect 26.6.5 update through Automate Product Updates.

Workarounds

CNA · ConnectWise

If you are unable to apply the update immediately due to maintenance windows or change-freeze policies, you can implement the following as a temporary mitigation to help reduce exposure until the update can be applied. This is not a substitute for installing the security update. * Navigate to the Administration > Security > Roles section. * Edit a role, review each session group that has permissions assigned to it, and deselect the TransferFiles permission if it is selected. * Save your changes. Repeat for each role.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-84869 (GCVE-0-2026-84869)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: previdian

Details

References

FKIE_CVE-2026-84869

GHSA-RC8V-F46M-JCGM

WID-SEC-W-2026-3256

Solutions

Workarounds

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour